6849 matches found
CVE-2019-8139: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary Javascript code into the dynamic block when invoking page builder on a product...
PT-2019-18896
Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.19 Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 Description A stored cross-site scripting XSS issue exists, allowing an authenticated user to inject arbitrary Javascript code. This ...
PT-2019-18947
Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1 Description The issue allows an unauthenticated user to inject arbitrary JavaScript code due to the sanitization engine ignoring HTML comments. Recommendation...
CVE-2019-8233: Improper Neutralization of Input During Web Page Generation
In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments...
CVE-2019-8115: Improper Neutralization of Input During Web Page Generation
A reflected cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when adding an image for during simple product creation...
CVE-2019-8228: Improper Neutralization of Input During Web Page Generation
in Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code into transactional email page when creating a new email template or editing existing email template...
CVE-2019-8146: Improper Neutralization of Input During Web Page Generation
A stored cross-site scripting XSS vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code when adding a new customer attribute for stores...
PT-2019-18924
Name of the Vulnerable Software and Affected Versions Magento 2.3 versions prior to 2.3.3 Magento 2.3 versions prior to 2.3.2-p1 Description A stored cross-site scripting XSS issue exists, allowing an authenticated admin user to inject arbitrary JavaScript code when creating a content page via th...
PT-2020-9824 · Otrs +2 · Otrs +2
Name of the Vulnerable Software and Affected Versions: Open Ticket Request System OTRS versions 7.0.x through 7.0.11 Open Ticket Request System OTRS Community Edition versions 5.0.x through 5.0.37 Open Ticket Request System OTRS Community Edition versions 6.0.x through 6.0.22 Description: An issu...
CVE-2011-0428
Cross Site Scripting XSS in ikiwiki before 3.20110122 could allow remote attackers to insert arbitrary JavaScript due to insufficient checking in comments...
Cross-Site Scripting (XSS)
resque-cleaner is vulnerable to cross-site scripting XSS. A remote attacker is able to inject arbitrary Javascript into a victim's browser via the klass, from, to, page and exception parameters...
Cross-site Scripting in node-red-dashboard
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...
GHSA-XG59-M7WX-853Q Cross-site Scripting in node-red-dashboard
It is possible to inject JavaScript within node-red-dashboard versions prior to version 2.17.0 due to the uinotification node accepting raw HTML by default...
IBM Cloud Orchestrator Cross-Site Scripting Vulnerability
IBM Cloud Orchestrator is a suite of cloud management solutions from IBM in the United States. The program provides extended internal and external deployment of cloud services and application program interfaces and tools to extend the integration with existing environments and other functions. A...
PT-2019-17092
Name of the Vulnerable Software and Affected Versions IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise versions 2.4 through 2.4.0.5 IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise versions 2.5 through 2.5.0.9 Description The issue allows users to embed arbitrary JavaScrip...
IBM Maximo Asset Management Cross-Site Scripting Vulnerability (CNVD-2019-39205)
IBM Maximo Asset Management is a comprehensive asset lifecycle and maintenance management solution from IBM USA. The solution is capable of managing all types of assets, such as facilities, transportation, etc., on a single platform with a single point of control for these assets. A cross-site...
CVE-2019-18219
Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting XSS vulnerability, as it fails to validate user input. The affected components index.php, upgrade.php allow for JavaScript injection within both GET or POST requests, via a crafted URL or via the UpgradeMode POST parameter...
Cross site scripting
Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting XSS vulnerability, as it fails to validate user input. The affected components index.php, upgrade.php allow for JavaScript injection within both GET or POST requests, via a crafted URL or via the UpgradeMode POST parameter...
CVE-2019-18219
Sitemagic CMS 4.4.1 is affected by a Cross-Site-Scripting XSS vulnerability, as it fails to validate user input. The affected components index.php, upgrade.php allow for JavaScript injection within both GET or POST requests, via a crafted URL or via the UpgradeMode POST parameter...
